Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1341722 > unrolled thread

[PATCH 3.12 001/142] dcache: use IS_ROOT to decide where dentry is hashed

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  [PATCH 3.12 001/142] dcache: use IS_ROOT to decide where dentry is hashed Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:10 +0100
    [PATCH 3.12 140/142] module: wrapper for symbol name. Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:10 +0100
    [PATCH 3.12 103/142] SCSI: Add Marvell Console to VPD blacklist Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:10 +0100
    [PATCH 3.12 141/142] libxfs: pack the agfl header structure so XFS_AGFL_SIZE is correct Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:10 +0100
    [PATCH 3.12 130/142] xhci: Fix list corruption in urb dequeue at host removal Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 137/142] dump_stack: avoid potential deadlocks Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 133/142] scripts/bloat-o-meter: fix python3 syntax error Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 106/142] iio: lpc32xx_adc: fix warnings caused by enabling unprepared clock Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 138/142] intel_scu_ipcutil: underflow in scu_reg_access() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 125/142] Input: elantech - add Fujitsu Lifebook U745 to force crc_enabled Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 135/142] radix-tree: fix race in gang lookup Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 129/142] mm/memory_hotplug.c: check for missing sections in test_pages_in_a_zone() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 127/142] Input: i8042 - add Fujitsu Lifebook U745 to the nomux list Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 126/142] Input: elantech - mark protocols v2 and v3 as semi-mt Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 120/142] ARM: 8519/1: ICST: try other dividends than 1 Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 132/142] dma-debug: switch check from _text to _stext Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 128/142] iommu/vt-d: Fix 64-bit accesses to 32-bit DMAR_GSTS_REG Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 134/142] memcg: only free spare array when readers are done Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 119/142] ARM: 8471/1: need to save/restore arm register(r11) when it is corrupted Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 105/142] iio:ad7793: Fix ad7785 product ID Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 131/142] m32r: fix m32104ut_defconfig build fail Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 136/142] radix-tree: fix oops after radix_tree_iter_retry Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:20 +0100
    [PATCH 3.12 117/142] udf: Check output buffer length when converting name to CS0 Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 116/142] udf: Prevent buffer overrun with multi-byte characters Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 121/142] ARM: 8517/1: ICST: avoid arithmetic overflow in icst_hz() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 124/142] mm: fix mlock accouting Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 122/142] fuse: break infinite loop in fuse_fill_write_pages() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 108/142] iio: ad5064: Fix ad5629/ad5669 shift Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 114/142] nfs: Fix race in __update_open_stateid() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 112/142] cifs_dbg() outputs an uninitialized buffer in cifs_readdir() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 109/142] iio: fix some warning messages Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 102/142] scsi_dh_rdac: always retry MODE SELECT on command lock violation Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 118/142] ARM: dts: Kirkwood: Fix QNAP TS219 power-off Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 099/142] iscsi-target: Fix potential dead-lock during node acl delete Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 101/142] drivers/scsi/sg.c: mark VMA as VM_IO to prevent migration Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 123/142] mm: soft-offline: check return value in second __get_any_page() call Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 113/142] cifs: fix erroneous return value Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 111/142] iio: dac: mcp4725: set iio name property in sysfs Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 110/142] iio: adis_buffer: Fix out-of-bounds memory access Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 115/142] udf: limit the maximum number of indirect extents in a row Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 068/142] ahci: Intel DNV device IDs SATA Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:30 +0100
    [PATCH 3.12 090/142] ptrace: use fsuid, fsgid, effective creds for fs access checks Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 088/142] perf: Fix inherited events vs. tracepoint filters Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 094/142] scsi: restart list search after unlock in scsi_remove_target Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 089/142] perf trace: Fix documentation for -i Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 085/142] ext4: fix potential integer overflow Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 065/142] crypto: algif_hash - Require setkey before accept(2) Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 083/142] serial: 8250_pci: Correct uartclk for xr17v35x expansion chips Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 093/142] klist: fix starting point removed bug in klist iterators Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 095/142] scsi_sysfs: Fix queue_ramp_up_period return code Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 086/142] btrfs: properly set the termination value of ctx->pos in readdir Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 091/142] tools lib traceevent: Fix output of %llu for 64 bit values read on 32 bit machines Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 087/142] Btrfs: fix hang on extent buffer lock caused by the inode_paths ioctl Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 098/142] SCSI: Fix NULL pointer dereference in runtime PM Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 096/142] iscsi-target: Fix rx_login_comp hang after login failure Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 082/142] pty: make sure super_block is still valid in final /dev/tty close Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 100/142] SCSI: fix crashes in sd and sr runtime PM Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 092/142] tracing: Fix freak link error caused by branch tracer Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 066/142] AHCI: Fix softreset failed issue of Port Multiplier Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 097/142] Fix a memory leak in scsi_host_dev_release() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:40 +0100
    [PATCH 3.12 074/142] tty: remove platform_sysrq_reset_seq Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 077/142] ALSA: seq: Fix double port list deletion Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 062/142] crypto: af_alg - Add nokey compatibility path Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 081/142] pty: fix possible use after free of tty->driver_data Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 073/142] binfmt_elf: Don't clobber passed executable's file header Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 060/142] crypto: af_alg - Disallow bind/setkey/... after accept(2) Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 076/142] x86/mm/pat: Avoid truncation when converting cpa->numpages to address Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 002/142] pipe: Fix buffer offset after partially failed read Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 064/142] crypto: hash - Add crypto_ahash_has_setkey Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 063/142] crypto: algif_skcipher - Add nokey compatibility path Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 072/142] FS-Cache: Don't override netfs's primary_index if registering failed Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 078/142] phy: twl4030-usb: Relase usb phy on unload Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 070/142] crypto: user - lock crypto_alg_list on alg dump Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 080/142] staging/speakup: Use tty_ldisc_ref() for paste kworker Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 061/142] crypto: af_alg - Fix socket double-free when accept fails Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 071/142] FS-Cache: Increase reference of parent after registering, netfs success Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 079/142] wan/x25: Fix use-after-free in x25_asy_open_tty() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 059/142] crypto: algif_skcipher - Require setkey before accept(2) Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 075/142] s390: fix normalization bug in exception table sorting Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 084/142] AIO: properly check iovec sizes Jiri Slaby <jslaby@suse.cz> - 2016-02-24 11:50 +0100
    [PATCH 3.12 054/142] USB: option: fix Cinterion AHxx enumeration Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:00 +0100
    [PATCH 3.12 058/142] ext4: Fix handling of extended tv_sec Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:00 +0100
    [PATCH 3.12 057/142] xhci: fix usb2 resume timing and races. Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:00 +0100
    [PATCH 3.12 003/142] Revert "ocfs2: fix umask ignored issue" Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:00 +0100
    [PATCH 3.12 052/142] USB: cp210x: add ID for IAI USB to RS485 adaptor Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:00 +0100
    [PATCH 3.12 051/142] USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:00 +0100
    [PATCH 3.12 055/142] tty: Fix GPF in flush_to_ldisc() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:00 +0100
    [PATCH 3.12 056/142] tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:00 +0100
    [PATCH 3.12 039/142] ALSA: seq: Fix lockdep warnings due to double mutex locks Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 053/142] USB: serial: option: Adding support for Telit LE922 Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 042/142] ALSA: timer: Fix link corruption due to double start or stop Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 010/142] sh64: fix __NR_fgetxattr Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 050/142] USB: serial: visor: fix crash on detecting device without write_urbs Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 004/142] proc: actually make proc_fd_permission() thread-friendly Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 047/142] ALSA: hda - Fix speaker output from VAIO AiO machines Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 040/142] ALSA: timer: Code cleanup Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 045/142] ALSA: hda - Add fixup for Mac Mini 7,1 model Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 048/142] ALSA: dummy: Implement timer backend switching more safely Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 044/142] ALSA: timer: Fix race between stop and interrupt Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 043/142] ALSA: timer: Fix wrong instance passed to slave callbacks Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 046/142] ALSA: hda - Fix static checker warning in patch_hdmi.c Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 041/142] ALSA: timer: Fix leftover link at closing Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 038/142] ALSA: seq: Fix race at closing in virmidi driver Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 049/142] saa7134-alsa: Only frees registered sound cards Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:10 +0100
    [PATCH 3.12 032/142] ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 031/142] ALSA: dummy: Disable switching timer backend via sysfs Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 022/142] parisc: Drop unused MADV_xxxK_PAGES flags from asm/mman.h Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 024/142] parisc: Fix __ARCH_SI_PREAMBLE_SIZE Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 029/142] ALSA: usb-audio: avoid freeing umidi object twice Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 019/142] tracing: Fix setting of start_index in find_next() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 025/142] v4l2-compat-ioctl32: fix alignment for ARM64 Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 030/142] ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 005/142] remoteproc: avoid stack overflow in debugfs file Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 028/142] ALSA: usb-audio: Fix TEAC UD-501/UD-503/NT-503 usb delay Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 026/142] media: vb2 dma-contig: Fully cache synchronise buffers in prepare and finish Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 021/142] fix calculation of meta_bg descriptor backups Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 007/142] kernel/signal.c: unexport sigsuspend() Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 035/142] ALSA: pcm: Fix potential deadlock in OSS emulation Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 034/142] ALSA: rawmidi: Fix race at copying & updating the position Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 037/142] ALSA: seq: Fix yet another races among ALSA timer accesses Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 023/142] parisc: Fix syscall restarts Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 027/142] fix sysvfs symlinks Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 020/142] jbd2: Fix unreclaimed pages after truncate in data=journal mode Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 009/142] ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 006/142] fat: fix fake_offset handling on error path Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 033/142] ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 036/142] ASoC: dpcm: fix the BE state on hw_free Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:20 +0100
    [PATCH 3.12 017/142] vTPM: fix memory allocation flag for rtce buffer at kernel boot Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100
    [PATCH 3.12 014/142] spi: fix parent-device reference leak Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100
    [PATCH 3.12 011/142] Revert "dm mpath: fix stalls when handling invalid ioctls" Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100
    [PATCH 3.12 018/142] mtd: mtdpart: fix add_mtd_partitions error path Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100
    [PATCH 3.12 016/142] wlcore/wl12xx: spi: fix NULL pointer dereference (Oops) Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100
    [PATCH 3.12 012/142] spi: atmel: Fix DMA-setup for transfers with more than 8 bits per word Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100
    [PATCH 3.12 013/142] spi: ti-qspi: Fix data corruption seen on r/w stress test Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100
    [PATCH 3.12 008/142] ocfs2/dlm: ignore cleaning the migration mle that is inuse Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100
    [PATCH 3.12 015/142] wlcore/wl12xx: spi: fix oops on firmware load Jiri Slaby <jslaby@suse.cz> - 2016-02-24 12:30 +0100

Page 7 of 7 — ← Prev page 1 2 3 4 5 6 [7]

#1341890 — [PATCH 3.12 023/142] parisc: Fix syscall restarts

From: Helge Deller <deller@gmx.de>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 71a71fb5374a23be36a91981b5614590b9e722c3 upstream.

On parisc syscalls which are interrupted by signals sometimes failed to
restart and instead returned -ENOSYS which in the worst case lead to
userspace crashes.
A similiar problem existed on MIPS and was fixed by commit e967ef02
("MIPS: Fix restart of indirect syscalls").

On parisc the current syscall restart code assumes that all syscall
callers load the syscall number in the delay slot of the ble
instruction. That's how it is e.g. done in the unistd.h header file:
	ble 0x100(%sr2, %r0)
	ldi #syscall_nr, %r20
Because of that assumption the current code never restored %r20 before
returning to userspace.

This assumption is at least not true for code which uses the glibc
syscall() function, which instead uses this syntax:
	ble 0x100(%sr2, %r0)
	copy regX, %r20
where regX depend on how the compiler optimizes the code and register
usage.

This patch fixes this problem by adding code to analyze how the syscall
number is loaded in the delay branch and - if needed - copy the syscall
number to regX prior returning to userspace for the syscall restart.

Signed-off-by: Helge Deller <deller@gmx.de>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 arch/parisc/kernel/signal.c | 64 ++++++++++++++++++++++++++++++++++++---------
 1 file changed, 52 insertions(+), 12 deletions(-)

diff --git a/arch/parisc/kernel/signal.c b/arch/parisc/kernel/signal.c
index 1cba8f29bb49..78bb6dd88e03 100644
--- a/arch/parisc/kernel/signal.c
+++ b/arch/parisc/kernel/signal.c
@@ -442,6 +442,55 @@ handle_signal(unsigned long sig, siginfo_t *info, struct k_sigaction *ka,
 		regs->gr[28]);
 }
 
+/*
+ * Check how the syscall number gets loaded into %r20 within
+ * the delay branch in userspace and adjust as needed.
+ */
+
+static void check_syscallno_in_delay_branch(struct pt_regs *regs)
+{
+	u32 opcode, source_reg;
+	u32 __user *uaddr;
+	int err;
+
+	/* Usually we don't have to restore %r20 (the system call number)
+	 * because it gets loaded in the delay slot of the branch external
+	 * instruction via the ldi instruction.
+	 * In some cases a register-to-register copy instruction might have
+	 * been used instead, in which case we need to copy the syscall
+	 * number into the source register before returning to userspace.
+	 */
+
+	/* A syscall is just a branch, so all we have to do is fiddle the
+	 * return pointer so that the ble instruction gets executed again.
+	 */
+	regs->gr[31] -= 8; /* delayed branching */
+
+	/* Get assembler opcode of code in delay branch */
+	uaddr = (unsigned int *) ((regs->gr[31] & ~3) + 4);
+	err = get_user(opcode, uaddr);
+	if (err)
+		return;
+
+	/* Check if delay branch uses "ldi int,%r20" */
+	if ((opcode & 0xffff0000) == 0x34140000)
+		return;	/* everything ok, just return */
+
+	/* Check if delay branch uses "nop" */
+	if (opcode == INSN_NOP)
+		return;
+
+	/* Check if delay branch uses "copy %rX,%r20" */
+	if ((opcode & 0xffe0ffff) == 0x08000254) {
+		source_reg = (opcode >> 16) & 31;
+		regs->gr[source_reg] = regs->gr[20];
+		return;
+	}
+
+	pr_warn("syscall restart: %s (pid %d): unexpected opcode 0x%08x\n",
+		current->comm, task_pid_nr(current), opcode);
+}
+
 static inline void
 syscall_restart(struct pt_regs *regs, struct k_sigaction *ka)
 {
@@ -464,10 +513,7 @@ syscall_restart(struct pt_regs *regs, struct k_sigaction *ka)
 		}
 		/* fallthrough */
 	case -ERESTARTNOINTR:
-		/* A syscall is just a branch, so all
-		 * we have to do is fiddle the return pointer.
-		 */
-		regs->gr[31] -= 8; /* delayed branching */
+		check_syscallno_in_delay_branch(regs);
 		break;
 	}
 }
@@ -516,15 +562,9 @@ insert_restart_trampoline(struct pt_regs *regs)
 	}
 	case -ERESTARTNOHAND:
 	case -ERESTARTSYS:
-	case -ERESTARTNOINTR: {
-		/* Hooray for delayed branching.  We don't
-		 * have to restore %r20 (the system call
-		 * number) because it gets loaded in the delay
-		 * slot of the branch external instruction.
-		 */
-		regs->gr[31] -= 8;
+	case -ERESTARTNOINTR:
+		check_syscallno_in_delay_branch(regs);
 		return;
-	}
 	default:
 		break;
 	}
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341891 — [PATCH 3.12 027/142] fix sysvfs symlinks

From: Al Viro <viro@zeniv.linux.org.uk>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 0ebf7f10d67a70e120f365018f1c5fce9ddc567d upstream.

The thing got broken back in 2002 - sysvfs does *not* have inline
symlinks; even short ones have bodies stored in the first block
of file.  sysv_symlink() handles that correctly; unfortunately,
attempting to look an existing symlink up will end up confusing
them for inline symlinks, and interpret the block number containing
the body as the body itself.

Nobody has noticed until now, which says something about the level
of testing sysvfs gets ;-/

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 fs/sysv/inode.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/fs/sysv/inode.c b/fs/sysv/inode.c
index c327d4ee1235..7b3792e5844a 100644
--- a/fs/sysv/inode.c
+++ b/fs/sysv/inode.c
@@ -161,14 +161,8 @@ void sysv_set_inode(struct inode *inode, dev_t rdev)
 		inode->i_fop = &sysv_dir_operations;
 		inode->i_mapping->a_ops = &sysv_aops;
 	} else if (S_ISLNK(inode->i_mode)) {
-		if (inode->i_blocks) {
-			inode->i_op = &sysv_symlink_inode_operations;
-			inode->i_mapping->a_ops = &sysv_aops;
-		} else {
-			inode->i_op = &sysv_fast_symlink_inode_operations;
-			nd_terminate_link(SYSV_I(inode)->i_data, inode->i_size,
-				sizeof(SYSV_I(inode)->i_data) - 1);
-		}
+		inode->i_op = &sysv_symlink_inode_operations;
+		inode->i_mapping->a_ops = &sysv_aops;
 	} else
 		init_special_inode(inode, inode->i_mode, rdev);
 }
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341893 — [PATCH 3.12 020/142] jbd2: Fix unreclaimed pages after truncate in data=journal mode

From: Jan Kara <jack@suse.cz>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit bc23f0c8d7ccd8d924c4e70ce311288cb3e61ea8 upstream.

Ted and Namjae have reported that truncated pages don't get timely
reclaimed after being truncated in data=journal mode. The following test
triggers the issue easily:

for (i = 0; i < 1000; i++) {
	pwrite(fd, buf, 1024*1024, 0);
	fsync(fd);
	fsync(fd);
	ftruncate(fd, 0);
}

The reason is that journal_unmap_buffer() finds that truncated buffers
are not journalled (jh->b_transaction == NULL), they are part of
checkpoint list of a transaction (jh->b_cp_transaction != NULL) and have
been already written out (!buffer_dirty(bh)). We clean such buffers but
we leave them in the checkpoint list. Since checkpoint transaction holds
a reference to the journal head, these buffers cannot be released until
the checkpoint transaction is cleaned up. And at that point we don't
call release_buffer_page() anymore so pages detached from mapping are
lingering in the system waiting for reclaim to find them and free them.

Fix the problem by removing buffers from transaction checkpoint lists
when journal_unmap_buffer() finds out they don't have to be there
anymore.

Reported-and-tested-by: Namjae Jeon <namjae.jeon@samsung.com>
Fixes: de1b794130b130e77ffa975bb58cb843744f9ae5
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 fs/jbd2/transaction.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 775a9e1c0c45..f18b5352df02 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -2066,6 +2066,7 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh,
 
 		if (!buffer_dirty(bh)) {
 			/* bdflush has written it.  We can drop it now */
+			__jbd2_journal_remove_checkpoint(jh);
 			goto zap_buffer;
 		}
 
@@ -2095,6 +2096,7 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh,
 				/* The orphan record's transaction has
 				 * committed.  We can cleanse this buffer */
 				clear_buffer_jbddirty(bh);
+				__jbd2_journal_remove_checkpoint(jh);
 				goto zap_buffer;
 			}
 		}
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341894 — [PATCH 3.12 009/142] ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup

From: xuejiufei <xuejiufei@huawei.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit c95a51807b730e4681e2ecbdfd669ca52601959e upstream.

When recovery master down, dlm_do_local_recovery_cleanup() only remove
the $RECOVERY lock owned by dead node, but do not clear the refmap bit.
Which will make umount thread falling in dead loop migrating $RECOVERY
to the dead node.

Signed-off-by: xuejiufei <xuejiufei@huawei.com>
Reviewed-by: Joseph Qi <joseph.qi@huawei.com>
Cc: Mark Fasheh <mfasheh@suse.de>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 fs/ocfs2/dlm/dlmrecovery.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index 7b4a3fa63fab..12b035548e45 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -2325,6 +2325,8 @@ static void dlm_do_local_recovery_cleanup(struct dlm_ctxt *dlm, u8 dead_node)
 						break;
 					}
 				}
+				dlm_lockres_clear_refmap_bit(dlm, res,
+						dead_node);
 				spin_unlock(&res->spinlock);
 				continue;
 			}
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341895 — [PATCH 3.12 006/142] fat: fix fake_offset handling on error path

From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 928a477102c4fc6739883415b66987207e3502f4 upstream.

For the root directory, .  and ..  are faked (using dir_emit_dots()) and
ctx->pos is reset from 2 to 0.

A corrupted root directory could cause fat_get_entry() to fail, but
->iterate() (fat_readdir()) reports progress to the VFS (with ctx->pos
rewound to 0), so any following calls to ->iterate() continue to return
the same entries again and again.

The result is that userspace will never see the end of the directory,
causing e.g.  'ls' to hang in a getdents() loop.

[hirofumi@mail.parknet.co.jp: cleanup and make sure to correct fake_offset]
Reported-by: Vegard Nossum <vegard.nossum@oracle.com>
Tested-by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: Richard Weinberger <richard.weinberger@gmail.com>
Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 fs/fat/dir.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/fs/fat/dir.c b/fs/fat/dir.c
index 3963ede84eb0..75bf5e717ed8 100644
--- a/fs/fat/dir.c
+++ b/fs/fat/dir.c
@@ -614,9 +614,9 @@ parse_record:
 		int status = fat_parse_long(inode, &cpos, &bh, &de,
 					    &unicode, &nr_slots);
 		if (status < 0) {
-			ctx->pos = cpos;
+			bh = NULL;
 			ret = status;
-			goto out;
+			goto end_of_dir;
 		} else if (status == PARSE_INVALID)
 			goto record_end;
 		else if (status == PARSE_NOT_LONGNAME)
@@ -658,8 +658,9 @@ parse_record:
 	fill_len = short_len;
 
 start_filldir:
-	if (!fake_offset)
-		ctx->pos = cpos - (nr_slots + 1) * sizeof(struct msdos_dir_entry);
+	ctx->pos = cpos - (nr_slots + 1) * sizeof(struct msdos_dir_entry);
+	if (fake_offset && ctx->pos < 2)
+		ctx->pos = 2;
 
 	if (!memcmp(de->name, MSDOS_DOT, MSDOS_NAME)) {
 		if (!dir_emit_dot(file, ctx))
@@ -685,14 +686,19 @@ record_end:
 	fake_offset = 0;
 	ctx->pos = cpos;
 	goto get_new;
+
 end_of_dir:
-	ctx->pos = cpos;
+	if (fake_offset && cpos < 2)
+		ctx->pos = 2;
+	else
+		ctx->pos = cpos;
 fill_failed:
 	brelse(bh);
 	if (unicode)
 		__putname(unicode);
 out:
 	mutex_unlock(&sbi->s_lock);
+
 	return ret;
 }
 
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341896 — [PATCH 3.12 033/142] ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check

From: Takashi Iwai <tiwai@suse.de>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit cc85f7a634cfaf9f0713c6aa06d08817424db37a upstream.

NULL user-space buffer can be passed even in a normal path, thus it's
not good to spew a kernel warning with stack trace at each time.
Just drop snd_BUG_ON() macro usage there.

BugLink: http://lkml.kernel.org/r/CACT4Y+YfVJ3L+q0i-4vyQVyyPD7V=OMX0PWPi29x9Bo3QaBLdw@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 sound/core/rawmidi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index 7b596b5751db..b600dc2a9a40 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -1162,7 +1162,7 @@ static long snd_rawmidi_kernel_write1(struct snd_rawmidi_substream *substream,
 	long count1, result;
 	struct snd_rawmidi_runtime *runtime = substream->runtime;
 
-	if (snd_BUG_ON(!kernelbuf && !userbuf))
+	if (!kernelbuf && !userbuf)
 		return -EINVAL;
 	if (snd_BUG_ON(!runtime->buffer))
 		return -EINVAL;
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341897 — [PATCH 3.12 036/142] ASoC: dpcm: fix the BE state on hw_free

From: Vinod Koul <vinod.koul@intel.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 5e82d2be6ee53275c72e964507518d7964c82753 upstream.

While performing hw_free, DPCM checks the BE state but leaves out
the suspend state. The suspend state needs to be checked as well,
as we might be suspended and then usermode closes rather than
resuming the audio stream.

This was found by a stress testing of system with playback in
loop and killed after few seconds running in background and second
script running suspend-resume test in loop

Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Acked-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 sound/soc/soc-pcm.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index 8457ebb7439e..81e2efd07cfd 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -1275,7 +1275,8 @@ static int dpcm_be_dai_hw_free(struct snd_soc_pcm_runtime *fe, int stream)
 		    (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PREPARE) &&
 		    (be->dpcm[stream].state != SND_SOC_DPCM_STATE_HW_FREE) &&
 		    (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PAUSED) &&
-		    (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP))
+		    (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP) &&
+		    (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND))
 			continue;
 
 		dev_dbg(be->dev, "ASoC: hw_free BE %s\n",
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341898 — [PATCH 3.12 017/142] vTPM: fix memory allocation flag for rtce buffer at kernel boot

From: "Hon Ching \\(Vicky\\) Lo" <honclo@linux.vnet.ibm.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 60ecd86c4d985750efa0ea3d8610972b09951715 upstream.

At ibm vtpm initialzation, tpm_ibmvtpm_probe() registers its interrupt
handler, ibmvtpm_interrupt, which calls ibmvtpm_crq_process to allocate
memory for rtce buffer.  The current code uses 'GFP_KERNEL' as the
type of kernel memory allocation, which resulted a warning at
kernel/lockdep.c.  This patch uses 'GFP_ATOMIC' instead so that the
allocation is high-priority and does not sleep.

Signed-off-by: Hon Ching(Vicky) Lo <honclo@linux.vnet.ibm.com>
Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/char/tpm/tpm_ibmvtpm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
index a6524c3efdf7..ce854bbd33ef 100644
--- a/drivers/char/tpm/tpm_ibmvtpm.c
+++ b/drivers/char/tpm/tpm_ibmvtpm.c
@@ -529,7 +529,7 @@ static void ibmvtpm_crq_process(struct ibmvtpm_crq *crq,
 			}
 			ibmvtpm->rtce_size = be16_to_cpu(crq->len);
 			ibmvtpm->rtce_buf = kmalloc(ibmvtpm->rtce_size,
-						    GFP_KERNEL);
+						    GFP_ATOMIC);
 			if (!ibmvtpm->rtce_buf) {
 				dev_err(ibmvtpm->dev, "Failed to allocate memory for rtce buffer\n");
 				return;
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341901 — [PATCH 3.12 014/142] spi: fix parent-device reference leak

From: Johan Hovold <johan@kernel.org>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 157f38f993919b648187ba341bfb05d0e91ad2f6 upstream.

Fix parent-device reference leak due to SPI-core taking an unnecessary
reference to the parent when allocating the master structure, a
reference that was never released.

Note that driver core takes its own reference to the parent when the
master device is registered.

Fixes: 49dce689ad4e ("spi doesn't need class_device")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/spi/spi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 5ddda10472c6..1470ee2660c3 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1104,7 +1104,7 @@ struct spi_master *spi_alloc_master(struct device *dev, unsigned size)
 	master->bus_num = -1;
 	master->num_chipselect = 1;
 	master->dev.class = &spi_master_class;
-	master->dev.parent = get_device(dev);
+	master->dev.parent = dev;
 	spi_master_set_devdata(master, &master[1]);
 
 	return master;
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341903 — [PATCH 3.12 011/142] Revert "dm mpath: fix stalls when handling invalid ioctls"

From: Mauricio Faria de Oliveira <mauricfo@linux.vnet.ibm.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 47796938c46b943d157ac8a6f9ed4e3b98b83cf4 upstream.

This reverts commit a1989b330093578ea5470bea0a00f940c444c466.

That commit introduced a regression at least for the case of the SG_IO ioctl()
running without CAP_SYS_RAWIO capability (e.g., unprivileged users) when there
are no active paths: the ioctl() fails with the ENOTTY errno immediately rather
than blocking due to queue_if_no_path until a path becomes active, for example.

That case happens to be exercised by QEMU KVM guests with 'scsi-block' devices
(qemu "-device scsi-block" [1], libvirt "<disk type='block' device='lun'>" [2])
from multipath devices; which leads to SCSI/filesystem errors in such a guest.

More general scenarios can hit that regression too. The following demonstration
employs a SG_IO ioctl() with a standard SCSI INQUIRY command for this objective
(some output & user changes omitted for brevity and comments added for clarity).

Reverting that commit restores normal operation (queueing) in failing scenarios;
tested on linux-next (next-20151022).

1) Test-case is based on sg_simple0 [3] (just SG_IO; remove SG_GET_VERSION_NUM)

    $ cat sg_simple0.c
    ... see [3] ...
    $ sed '/SG_GET_VERSION_NUM/,/}/d' sg_simple0.c > sgio_inquiry.c
    $ gcc sgio_inquiry.c -o sgio_inquiry

2) The ioctl() works fine with active paths present.

    # multipath -l 85ag56
    85ag56 (...) dm-19 IBM     ,2145
    size=60G features='1 queue_if_no_path' hwhandler='0' wp=rw
    |-+- policy='service-time 0' prio=0 status=active
    | |- 8:0:11:0  sdz  65:144  active undef running
    | `- 9:0:9:0   sdbf 67:144  active undef running
    `-+- policy='service-time 0' prio=0 status=enabled
      |- 8:0:12:0  sdae 65:224  active undef running
      `- 9:0:12:0  sdbo 68:32   active undef running

    $ ./sgio_inquiry /dev/mapper/85ag56
    Some of the INQUIRY command's response:
        IBM       2145              0000
    INQUIRY duration=0 millisecs, resid=0

3) The ioctl() fails with ENOTTY errno with _no_ active paths present,
   for unprivileged users (rather than blocking due to queue_if_no_path).

    # for path in $(multipath -l 85ag56 | grep -o 'sd[a-z]\+'); \
          do multipathd -k"fail path $path"; done

    # multipath -l 85ag56
    85ag56 (...) dm-19 IBM     ,2145
    size=60G features='1 queue_if_no_path' hwhandler='0' wp=rw
    |-+- policy='service-time 0' prio=0 status=enabled
    | |- 8:0:11:0  sdz  65:144  failed undef running
    | `- 9:0:9:0   sdbf 67:144  failed undef running
    `-+- policy='service-time 0' prio=0 status=enabled
      |- 8:0:12:0  sdae 65:224  failed undef running
      `- 9:0:12:0  sdbo 68:32   failed undef running

    $ ./sgio_inquiry /dev/mapper/85ag56
    sg_simple0: Inquiry SG_IO ioctl error: Inappropriate ioctl for device

4) dmesg shows that scsi_verify_blk_ioctl() failed for SG_IO (0x2285);
   it returns -ENOIOCTLCMD, later replaced with -ENOTTY in vfs_ioctl().

    $ dmesg
    <...>
    [] device-mapper: multipath: Failing path 65:144.
    [] device-mapper: multipath: Failing path 67:144.
    [] device-mapper: multipath: Failing path 65:224.
    [] device-mapper: multipath: Failing path 68:32.
    [] sgio_inquiry: sending ioctl 2285 to a partition!

5) The ioctl() only works if the SYS_CAP_RAWIO capability is present
   (then queueing happens -- in this example, queue_if_no_path is set);
   this is due to a conditional check in scsi_verify_blk_ioctl().

    # capsh --drop=cap_sys_rawio -- -c './sgio_inquiry /dev/mapper/85ag56'
    sg_simple0: Inquiry SG_IO ioctl error: Inappropriate ioctl for device

    # ./sgio_inquiry /dev/mapper/85ag56 &
    [1] 72830

    # cat /proc/72830/stack
    [<c00000171c0df700>] 0xc00000171c0df700
    [<c000000000015934>] __switch_to+0x204/0x350
    [<c000000000152d4c>] msleep+0x5c/0x80
    [<c00000000077dfb0>] dm_blk_ioctl+0x70/0x170
    [<c000000000487c40>] blkdev_ioctl+0x2b0/0x9b0
    [<c0000000003128e4>] block_ioctl+0x64/0xd0
    [<c0000000002dd3b0>] do_vfs_ioctl+0x490/0x780
    [<c0000000002dd774>] SyS_ioctl+0xd4/0xf0
    [<c000000000009358>] system_call+0x38/0xd0

6) This is the function call chain exercised in this analysis:

SYSCALL_DEFINE3(ioctl, <...>) @ fs/ioctl.c
    -> do_vfs_ioctl()
        -> vfs_ioctl()
            ...
            error = filp->f_op->unlocked_ioctl(filp, cmd, arg);
            ...
                -> dm_blk_ioctl() @ drivers/md/dm.c
                    -> multipath_ioctl() @ drivers/md/dm-mpath.c
                        ...
                        (bdev = NULL, due to no active paths)
                        ...
                        if (!bdev || <...>) {
                            int err = scsi_verify_blk_ioctl(NULL, cmd);
                            if (err)
                                r = err;
                        }
                        ...
                            -> scsi_verify_blk_ioctl() @ block/scsi_ioctl.c
                                ...
                                if (bd && bd == bd->bd_contains) // not taken (bd = NULL)
                                    return 0;
                                ...
                                if (capable(CAP_SYS_RAWIO)) // not taken (unprivileged user)
                                    return 0;
                                ...
                                printk_ratelimited(KERN_WARNING
                                           "%s: sending ioctl %x to a partition!\n" <...>);

                                return -ENOIOCTLCMD;
                            <-
                        ...
                        return r ? : <...>
                    <-
            ...
            if (error == -ENOIOCTLCMD)
                error = -ENOTTY;
             out:
                return error;
            ...

Links:
[1] http://git.qemu.org/?p=qemu.git;a=commit;h=336a6915bc7089fb20fea4ba99972ad9a97c5f52
[2] https://libvirt.org/formatdomain.html#elementsDisks (see 'disk' -> 'device')
[3] http://tldp.org/HOWTO/SCSI-Generic-HOWTO/pexample.html (Revision 1.2, 2002-05-03)

Signed-off-by: Mauricio Faria de Oliveira <mauricfo@linux.vnet.ibm.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/md/dm-mpath.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 709ce1b2582e..799e479db93b 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -1623,11 +1623,8 @@ static int multipath_ioctl(struct dm_target *ti, unsigned int cmd,
 	/*
 	 * Only pass ioctls through if the device sizes match exactly.
 	 */
-	if (!bdev || ti->len != i_size_read(bdev->bd_inode) >> SECTOR_SHIFT) {
-		int err = scsi_verify_blk_ioctl(NULL, cmd);
-		if (err)
-			r = err;
-	}
+	if (!r && ti->len != i_size_read(bdev->bd_inode) >> SECTOR_SHIFT)
+		r = scsi_verify_blk_ioctl(NULL, cmd);
 
 	if (r == -ENOTCONN && !fatal_signal_pending(current))
 		queue_work(kmultipathd, &m->process_queued_ios);
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341906 — [PATCH 3.12 018/142] mtd: mtdpart: fix add_mtd_partitions error path

From: Boris BREZILLON <boris.brezillon@free-electrons.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit e5bae86797141e4a95e42d825f737cb36d7b8c37 upstream.

If we fail to allocate a partition structure in the middle of the partition
creation process, the already allocated partitions are never removed, which
means they are still present in the partition list and their resources are
never freed.

Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/mtd/mtdpart.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index 6e732c3820c1..51abd85e8a37 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -635,8 +635,10 @@ int add_mtd_partitions(struct mtd_info *master,
 
 	for (i = 0; i < nbparts; i++) {
 		slave = allocate_partition(master, parts + i, i, cur_offset);
-		if (IS_ERR(slave))
+		if (IS_ERR(slave)) {
+			del_mtd_partitions(master);
 			return PTR_ERR(slave);
+		}
 
 		mutex_lock(&mtd_partitions_mutex);
 		list_add(&slave->list, &mtd_partitions);
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341908 — [PATCH 3.12 016/142] wlcore/wl12xx: spi: fix NULL pointer dereference (Oops)

From: Uri Mashiach <uri.mashiach@compulab.co.il>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit e47301b06d5a65678690f04c2248fd181db1e59a upstream.

Fix the below Oops when trying to modprobe wlcore_spi.
The oops occurs because the wl1271_power_{off,on}()
function doesn't check the power() function pointer.

[   23.401447] Unable to handle kernel NULL pointer dereference at
virtual address 00000000
[   23.409954] pgd = c0004000
[   23.412922] [00000000] *pgd=00000000
[   23.416693] Internal error: Oops: 80000007 [#1] SMP ARM
[   23.422168] Modules linked in: wl12xx wlcore mac80211 cfg80211
musb_dsps musb_hdrc usbcore usb_common snd_soc_simple_card evdev joydev
omap_rng wlcore_spi snd_soc_tlv320aic23_i2c rng_core snd_soc_tlv320aic23
c_can_platform c_can can_dev snd_soc_davinci_mcasp snd_soc_edma
snd_soc_omap omap_wdt musb_am335x cpufreq_dt thermal_sys hwmon
[   23.453253] CPU: 0 PID: 36 Comm: kworker/0:2 Not tainted
4.2.0-00002-g951efee-dirty #233
[   23.461720] Hardware name: Generic AM33XX (Flattened Device Tree)
[   23.468123] Workqueue: events request_firmware_work_func
[   23.473690] task: de32efc0 ti: de4ee000 task.ti: de4ee000
[   23.479341] PC is at 0x0
[   23.482112] LR is at wl12xx_set_power_on+0x28/0x124 [wlcore]
[   23.488074] pc : [<00000000>]    lr : [<bf2581f0>]    psr: 60000013
[   23.488074] sp : de4efe50  ip : 00000002  fp : 00000000
[   23.500162] r10: de7cdd00  r9 : dc848800  r8 : bf27af00
[   23.505663] r7 : bf27a1a8  r6 : dcbd8a80  r5 : dce0e2e0  r4 :
dce0d2e0
[   23.512536] r3 : 00000000  r2 : 00000000  r1 : 00000001  r0 :
dc848810
[   23.519412] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM
Segment kernel
[   23.527109] Control: 10c5387d  Table: 9cb78019  DAC: 00000015
[   23.533160] Process kworker/0:2 (pid: 36, stack limit = 0xde4ee218)
[   23.539760] Stack: (0xde4efe50 to 0xde4f0000)

[...]

[   23.665030] [<bf2581f0>] (wl12xx_set_power_on [wlcore]) from
[<bf25f7ac>] (wlcore_nvs_cb+0x118/0xa4c [wlcore])
[   23.675604] [<bf25f7ac>] (wlcore_nvs_cb [wlcore]) from [<c04387ec>]
(request_firmware_work_func+0x30/0x58)
[   23.685784] [<c04387ec>] (request_firmware_work_func) from
[<c0058e2c>] (process_one_work+0x1b4/0x4b4)
[   23.695591] [<c0058e2c>] (process_one_work) from [<c0059168>]
(worker_thread+0x3c/0x4a4)
[   23.704124] [<c0059168>] (worker_thread) from [<c005ee68>]
(kthread+0xd4/0xf0)
[   23.711747] [<c005ee68>] (kthread) from [<c000f598>]
(ret_from_fork+0x14/0x3c)
[   23.719357] Code: bad PC value
[   23.722760] ---[ end trace 981be8510db9b3a9 ]---

Prevent oops by validationg power() pointer value before
calling the function.

Signed-off-by: Uri Mashiach <uri.mashiach@compulab.co.il>
Acked-by: Igor Grinberg <grinberg@compulab.co.il>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/net/wireless/ti/wlcore/io.h | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/ti/wlcore/io.h b/drivers/net/wireless/ti/wlcore/io.h
index af7d9f9b3b4d..beed58b0c795 100644
--- a/drivers/net/wireless/ti/wlcore/io.h
+++ b/drivers/net/wireless/ti/wlcore/io.h
@@ -203,19 +203,23 @@ static inline int __must_check wlcore_write_reg(struct wl1271 *wl, int reg,
 
 static inline void wl1271_power_off(struct wl1271 *wl)
 {
-	int ret;
+	int ret = 0;
 
 	if (!test_bit(WL1271_FLAG_GPIO_POWER, &wl->flags))
 		return;
 
-	ret = wl->if_ops->power(wl->dev, false);
+	if (wl->if_ops->power)
+		ret = wl->if_ops->power(wl->dev, false);
 	if (!ret)
 		clear_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
 }
 
 static inline int wl1271_power_on(struct wl1271 *wl)
 {
-	int ret = wl->if_ops->power(wl->dev, true);
+	int ret = 0;
+
+	if (wl->if_ops->power)
+		ret = wl->if_ops->power(wl->dev, true);
 	if (ret == 0)
 		set_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
 
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341909 — [PATCH 3.12 012/142] spi: atmel: Fix DMA-setup for transfers with more than 8 bits per word

From: David Mosberger-Tang <davidm@egauge.net>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 06515f83908d038d9e12ffa3dcca27a1b67f2de0 upstream.

The DMA-slave configuration depends on the whether <= 8 or > 8 bits
are transferred per word, so we need to call
atmel_spi_dma_slave_config() with the correct value.

Signed-off-by: David Mosberger <davidm@egauge.net>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/spi/spi-atmel.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index d4ac60b4a56e..72d21e87e649 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -606,7 +606,8 @@ static int atmel_spi_next_xfer_dma_submit(struct spi_master *master,
 
 	*plen = len;
 
-	if (atmel_spi_dma_slave_config(as, &slave_config, 8))
+	if (atmel_spi_dma_slave_config(as, &slave_config,
+				       xfer->bits_per_word))
 		goto err_exit;
 
 	/* Send both scatterlists */
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341913 — [PATCH 3.12 013/142] spi: ti-qspi: Fix data corruption seen on r/w stress test

From: Vignesh R <vigneshr@ti.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit bc27a53928981662079aa243915b443370294a03 upstream.

Writing invalid command to QSPI_SPI_CMD_REG will terminate current
transfer and de-assert the chip select. This has to be done before
calling spi_finalize_current_message(). Because
spi_finalize_current_message() will mark the end of current message
transfer and schedule the next transfer. If the chipselect is not
de-asserted before calling spi_finalize_current_message() then the next
transfer will overlap with the previous transfer leading to data
corruption.
__spi_pump_message() can be called either from kthread worker context or
directly from the calling process's context. It is possible that these
two calls can race against each other. But race is serialized by
checking whether master->cur_msg == NULL (pointer to msg being handled
by transfer_one() at present). The master->cur_msg is set to NULL when
spi_finalize_current_message() is called on that message, which means
calling spi_finalize_current_message() allows __spi_sync() to pump next
message in calling process context.
Now if spi-ti-qspi calls spi_finalize_current_message() before we
terminate transfer at hardware side, if __spi_pump_message() is called
from process context then the successive transactions can overlap.

Fix this by moving writing invalid command to QSPI_SPI_CMD_REG to
before calling spi_finalize_current_message() call.

Signed-off-by: Vignesh R <vigneshr@ti.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/spi/spi-ti-qspi.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
index e12d962a289f..6d0fb2209ebf 100644
--- a/drivers/spi/spi-ti-qspi.c
+++ b/drivers/spi/spi-ti-qspi.c
@@ -385,11 +385,10 @@ static int ti_qspi_start_transfer_one(struct spi_master *master,
 
 	mutex_unlock(&qspi->list_lock);
 
+	ti_qspi_write(qspi, qspi->cmd | QSPI_INVAL, QSPI_SPI_CMD_REG);
 	m->status = status;
 	spi_finalize_current_message(master);
 
-	ti_qspi_write(qspi, qspi->cmd | QSPI_INVAL, QSPI_SPI_CMD_REG);
-
 	return status;
 }
 
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341914 — [PATCH 3.12 008/142] ocfs2/dlm: ignore cleaning the migration mle that is inuse

From: xuejiufei <xuejiufei@huawei.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit bef5502de074b6f6fa647b94b73155d675694420 upstream.

We have found that migration source will trigger a BUG that the refcount
of mle is already zero before put when the target is down during
migration.  The situation is as follows:

dlm_migrate_lockres
  dlm_add_migration_mle
  dlm_mark_lockres_migrating
  dlm_get_mle_inuse
  <<<<<< Now the refcount of the mle is 2.
  dlm_send_one_lockres and wait for the target to become the
  new master.
  <<<<<< o2hb detect the target down and clean the migration
  mle. Now the refcount is 1.

dlm_migrate_lockres woken, and put the mle twice when found the target
goes down which trigger the BUG with the following message:

  "ERROR: bad mle: ".

Signed-off-by: Jiufei Xue <xuejiufei@huawei.com>
Reviewed-by: Joseph Qi <joseph.qi@huawei.com>
Cc: Mark Fasheh <mfasheh@suse.de>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 fs/ocfs2/dlm/dlmmaster.c | 26 +++++++++++++++-----------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index 4fe55b776a74..918fb3ec82f7 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -2453,6 +2453,11 @@ static int dlm_migrate_lockres(struct dlm_ctxt *dlm,
 	spin_lock(&dlm->master_lock);
 	ret = dlm_add_migration_mle(dlm, res, mle, &oldmle, name,
 				    namelen, target, dlm->node_num);
+	/* get an extra reference on the mle.
+	 * otherwise the assert_master from the new
+	 * master will destroy this.
+	 */
+	dlm_get_mle_inuse(mle);
 	spin_unlock(&dlm->master_lock);
 	spin_unlock(&dlm->spinlock);
 
@@ -2488,6 +2493,7 @@ fail:
 		if (mle_added) {
 			dlm_mle_detach_hb_events(dlm, mle);
 			dlm_put_mle(mle);
+			dlm_put_mle_inuse(mle);
 		} else if (mle) {
 			kmem_cache_free(dlm_mle_cache, mle);
 			mle = NULL;
@@ -2505,17 +2511,6 @@ fail:
 	 * ensure that all assert_master work is flushed. */
 	flush_workqueue(dlm->dlm_worker);
 
-	/* get an extra reference on the mle.
-	 * otherwise the assert_master from the new
-	 * master will destroy this.
-	 * also, make sure that all callers of dlm_get_mle
-	 * take both dlm->spinlock and dlm->master_lock */
-	spin_lock(&dlm->spinlock);
-	spin_lock(&dlm->master_lock);
-	dlm_get_mle_inuse(mle);
-	spin_unlock(&dlm->master_lock);
-	spin_unlock(&dlm->spinlock);
-
 	/* notify new node and send all lock state */
 	/* call send_one_lockres with migration flag.
 	 * this serves as notice to the target node that a
@@ -3240,6 +3235,15 @@ top:
 			    mle->new_master != dead_node)
 				continue;
 
+			if (mle->new_master == dead_node && mle->inuse) {
+				mlog(ML_NOTICE, "%s: target %u died during "
+						"migration from %u, the MLE is "
+						"still keep used, ignore it!\n",
+						dlm->name, dead_node,
+						mle->master);
+				continue;
+			}
+
 			/* If we have reached this point, this mle needs to be
 			 * removed from the list and freed. */
 			dlm_clean_migration_mle(dlm, mle);
-- 
2.7.1

[toc] | [prev] | [next] | [standalone]

#1341918 — [PATCH 3.12 015/142] wlcore/wl12xx: spi: fix oops on firmware load

From: Uri Mashiach <uri.mashiach@compulab.co.il>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 9b2761cb72dc41e1948c8a5512b4efd384eda130 upstream.

The maximum chunks used by the function is
(SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE + 1).
The original commands array had space for
(SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) commands.
When the last chunk is used (len > 4 * WSPI_MAX_CHUNK_SIZE), the last
command is stored outside the bounds of the commands array.

Oops 5 (page fault) is generated during current wl1271 firmware load
attempt:

root@debian-armhf:~# ifconfig wlan0 up
[  294.312399] Unable to handle kernel paging request at virtual address
00203fc4
[  294.320173] pgd = de528000
[  294.323028] [00203fc4] *pgd=00000000
[  294.326916] Internal error: Oops: 5 [#1] SMP ARM
[  294.331789] Modules linked in: bnep rfcomm bluetooth ipv6 arc4 wl12xx
wlcore mac80211 musb_dsps cfg80211 musb_hdrc usbcore usb_common
wlcore_spi omap_rng rng_core musb_am335x omap_wdt cpufreq_dt thermal_sys
hwmon
[  294.351838] CPU: 0 PID: 1827 Comm: ifconfig Not tainted
4.2.0-00002-g3e9ad27-dirty #78
[  294.360154] Hardware name: Generic AM33XX (Flattened Device Tree)
[  294.366557] task: dc9d6d40 ti: de550000 task.ti: de550000
[  294.372236] PC is at __spi_validate+0xa8/0x2ac
[  294.376902] LR is at __spi_sync+0x78/0x210
[  294.381200] pc : [<c049c760>]    lr : [<c049ebe0>]    psr: 60000013
[  294.381200] sp : de551998  ip : de5519d8  fp : 00200000
[  294.393242] r10: de551c8c  r9 : de5519d8  r8 : de3a9000
[  294.398730] r7 : de3a9258  r6 : de3a9400  r5 : de551a48  r4 :
00203fbc
[  294.405577] r3 : 00000000  r2 : 00000000  r1 : 00000000  r0 :
de3a9000
[  294.412420] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM
Segment user
[  294.419918] Control: 10c5387d  Table: 9e528019  DAC: 00000015
[  294.425954] Process ifconfig (pid: 1827, stack limit = 0xde550218)
[  294.432437] Stack: (0xde551998 to 0xde552000)

...

[  294.883613] [<c049c760>] (__spi_validate) from [<c049ebe0>]
(__spi_sync+0x78/0x210)
[  294.891670] [<c049ebe0>] (__spi_sync) from [<bf036598>]
(wl12xx_spi_raw_write+0xfc/0x148 [wlcore_spi])
[  294.901661] [<bf036598>] (wl12xx_spi_raw_write [wlcore_spi]) from
[<bf21c694>] (wlcore_boot_upload_firmware+0x1ec/0x458 [wlcore])
[  294.914038] [<bf21c694>] (wlcore_boot_upload_firmware [wlcore]) from
[<bf24532c>] (wl12xx_boot+0xc10/0xfac [wl12xx])
[  294.925161] [<bf24532c>] (wl12xx_boot [wl12xx]) from [<bf20d5cc>]
(wl1271_op_add_interface+0x5b0/0x910 [wlcore])
[  294.936364] [<bf20d5cc>] (wl1271_op_add_interface [wlcore]) from
[<bf15c4ac>] (ieee80211_do_open+0x44c/0xf7c [mac80211])
[  294.947963] [<bf15c4ac>] (ieee80211_do_open [mac80211]) from
[<c0537978>] (__dev_open+0xa8/0x110)
[  294.957307] [<c0537978>] (__dev_open) from [<c0537bf8>]
(__dev_change_flags+0x88/0x148)
[  294.965713] [<c0537bf8>] (__dev_change_flags) from [<c0537cd0>]
(dev_change_flags+0x18/0x48)
[  294.974576] [<c0537cd0>] (dev_change_flags) from [<c05a55a0>]
(devinet_ioctl+0x6b4/0x7d0)
[  294.983191] [<c05a55a0>] (devinet_ioctl) from [<c0517040>]
(sock_ioctl+0x1e4/0x2bc)
[  294.991244] [<c0517040>] (sock_ioctl) from [<c017d378>]
(do_vfs_ioctl+0x420/0x6b0)
[  294.999208] [<c017d378>] (do_vfs_ioctl) from [<c017d674>]
(SyS_ioctl+0x6c/0x7c)
[  295.006880] [<c017d674>] (SyS_ioctl) from [<c000f4c0>]
(ret_fast_syscall+0x0/0x54)
[  295.014835] Code: e1550004 e2444034 0a00007d e5953018 (e5942008)
[  295.021544] ---[ end trace 66ed188198f4e24e ]---

Signed-off-by: Uri Mashiach <uri.mashiach@compulab.co.il>
Acked-by: Igor Grinberg <grinberg@compulab.co.il>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/net/wireless/ti/wlcore/spi.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/ti/wlcore/spi.c b/drivers/net/wireless/ti/wlcore/spi.c
index 1b0cd98e35f1..5b287b7f96e6 100644
--- a/drivers/net/wireless/ti/wlcore/spi.c
+++ b/drivers/net/wireless/ti/wlcore/spi.c
@@ -72,7 +72,10 @@
  */
 #define SPI_AGGR_BUFFER_SIZE (4 * PAGE_SIZE)
 
-#define WSPI_MAX_NUM_OF_CHUNKS (SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE)
+/* Maximum number of SPI write chunks */
+#define WSPI_MAX_NUM_OF_CHUNKS \
+	((SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) + 1)
+
 
 struct wl12xx_spi_glue {
 	struct device *dev;
@@ -270,9 +273,10 @@ static int __must_check wl12xx_spi_raw_write(struct device *child, int addr,
 					     void *buf, size_t len, bool fixed)
 {
 	struct wl12xx_spi_glue *glue = dev_get_drvdata(child->parent);
-	struct spi_transfer t[2 * (WSPI_MAX_NUM_OF_CHUNKS + 1)];
+	/* SPI write buffers - 2 for each chunk */
+	struct spi_transfer t[2 * WSPI_MAX_NUM_OF_CHUNKS];
 	struct spi_message m;
-	u32 commands[WSPI_MAX_NUM_OF_CHUNKS];
+	u32 commands[WSPI_MAX_NUM_OF_CHUNKS]; /* 1 command per chunk */
 	u32 *cmd;
 	u32 chunk_len;
 	int i;
-- 
2.7.1

[toc] | [prev] | [standalone]

Page 7 of 7 — ← Prev page 1 2 3 4 5 6 [7]

Back to top | Article view | linux.kernel

csiph-web